I want to generate the audit log report with different activities and download to the local disc from SharePoint Online Site.

The functionality is provided by Share Gate tool which I assume to be implemented using PowerShell.

Any reference or code of the CSOM PowerShell or PNP to generate the report?

There is a tool available at this location . I want to develop the code which will extract the reports of SharePoint activities in this tool.

Thanks in advance.

1 Answer 1


There is a demo to get the audit data in one day in SharePoint online by PowerShell.

You should get your site id and change to your site id in the PowerShell script. And you also could change the time interval.

And it will save the audit data to the csv file on the local computer.

#Set-ExecutionPolicy RemoteSigned

# Option 1 - This can be used to be prompted for credentials
$UserCredential = Get-Credential

# Create the session to Exchange Online
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -Uri https://outlook.office365.com/powershell-liveid/  -Credential $UserCredential -Authentication Basic -AllowRedirection

# Import the Exchange Online commands
Import-PSSession $Session
$csvFile = "c:\test\auditlog2.csv"

# Setup our start and end dates to pull back events
#$start = Get-Date
$end = Get-Date
$start = $end.AddDays(-1)
$i = 1;
$startTime = Get-Date

    $AuditData = Search-UnifiedAuditLog -StartDate $start -EndDate $end -RecordType SharePointFileOperation -ResultSize 5000 -SessionCommand ReturnLargeSet -SessionId "ExtractLogs" -SiteIds yoursiteid
    $ConvertedOutput = $AuditData | Select-Object -ExpandProperty AuditData | ConvertFrom-Json
    $ConvertedOutput | SELECT CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent | Export-csv $csvFile -NoTypeInformation -Append -Force 
    Write-Host $i++ . $AuditData.Count
    $i = $i + 1;
Until($AuditData.Count -eq 0)

$endTime = Get-Date
Write-Host $startTime - $endTime

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

#Get Site Id
$credential = Get-Credential
$context = New-Object Microsoft.SharePoint.Client.ClientContext("yoursiteurl")
$context.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($credential.UserName,$credential.Password)
$site = $context.Site 

More references:

Retrieving Office 365 Audit Data using PowerShell.

Office 365/Sharepoint Online - PowerShell Script To Call Search API And Get The Result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.